What is adware and how do you remove it?

Adware is software that shows unwanted advertising, often by injecting ads into browsers or the desktop, and may also track browsing or change settings. Some adware is merely annoying and some is a doorway for worse malware. Remove it by uninstalling unknown programs and extensions, then scanning and resetting browser settings.

How does it get onto a device?

• Bundling. Free software installs extra programs unless you notice and untick them.
• Browser extensions. An extension that looks useful asks for broad permissions to read and change pages. MITRE notes in its browser and software extension technique that extensions often inherit the permissions of their host application and arrive through official marketplaces, compromised marketplaces or user installation, and that this applies to browsers and development environments alike.
• Fake downloads and prompts. A pop up claims your player is out of date.
• Mobile apps. Apps outside official stores, or with aggressive ad permissions.
• Malicious ads. An ad itself leads to a download.

CISA's advice on malicious code notes that free software can contain a Trojan horse, with the user thinking the program is legitimate while it does something else. Adware bundles follow a similar pattern, so treat free tools from unknown publishers with care.

How do you know you have it?

• Pop ups when no browser is open, or ads in places they should not appear.
• A changed homepage, new search engine or new toolbar.
• Pages that redirect to ad networks.
• The device slows down or the browser crashes more.
• Programs or extensions you do not remember installing.
• On a phone: ads on the lock screen, unexpected battery drain or apps you did not install.

Is it dangerous?

It varies. Basic adware wastes time and attention. More aggressive versions collect browsing data, replace search results, insert affiliate tags or load additional software. A powerful extension can read what you type into pages, including passwords, which is why extension permissions deserve attention. The line between adware and malware can be thin.

Constructed example: a user installs a free PDF converter and clicks through the installer quickly. Two days later the browser has a new search engine, a toolbar and a coupon extension that can read all pages. Search results lead to sponsored links. The converter is fine, but the bundled extension is the adware. Removing the extension and resetting search settings fixes it.

How to check or apply this

1. Disconnect sensitive sessions. Sign out of banking and email in the affected browser.
2. Uninstall unknown programs. Sort installed apps by date and remove anything you do not recognize from around the time the problem started.
3. Remove extensions. Open the extensions page in each browser and delete anything unfamiliar or unneeded.
4. Reset browser settings, including homepage, search engine and notification permissions.
5. Scan the device with your endpoint protection or a reputable malware scanner, updated first.
6. Check startup items and scheduled tasks for entries you do not recognize.
7. Change passwords from a clean device if you suspect the extension could read what you typed.
8. On a phone, remove unfamiliar apps, review which apps may display over others and which have device administrator access.
9. Prevent a repeat. Download from official sources, choose custom install to untick extras, and approve few extensions.
10. In a company, restrict installs to an approved list and manage browser extensions centrally.

Developers should note that the same extension risk applies to code editors. Safeguard has IDE extensions and a Gold Open Source browser extension, and you should still review what permissions any extension requests before installing it.

Quick check

Sources

• MITRE ATT&CK T1176, Software Extensions
• CISA, Protecting Against Malicious Code

Last reviewed: 18 October 2026.